CVE-2023-39643
📋 TL;DR
This CVE describes a SQL injection vulnerability in the Bl Modules xmlfeeds PrestaShop module before version 3.9.8. Attackers can exploit the SearchApiXml::Xmlfeeds() component to execute arbitrary SQL commands, potentially compromising the database. All PrestaShop installations using vulnerable versions of this module are affected.
💻 Affected Systems
- Bl Modules xmlfeeds PrestaShop module
📦 What is this software?
Xmlfeeds Pro by Blmodules
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to data theft, data manipulation, privilege escalation, or complete system takeover via SQL injection to RCE chaining.
Likely Case
Database information disclosure, data manipulation, or authentication bypass through SQL injection.
If Mitigated
Limited impact with proper input validation, parameterized queries, and WAF protection blocking malicious SQL patterns.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized; the specific component is accessible via API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.8
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/08/29/xmlfeeds.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'xmlfeeds' module. 4. Update to version 3.9.8 or later via the update button or manual upload.
🔧 Temporary Workarounds
Disable xmlfeeds module
allTemporarily disable the vulnerable module until patching is possible.
WAF rule for SQL injection
allImplement web application firewall rules to block SQL injection patterns targeting the SearchApiXml::Xmlfeeds() endpoint.
🧯 If You Can't Patch
- Restrict network access to the PrestaShop instance to trusted IPs only.
- Implement strict input validation and sanitization for all user inputs to the xmlfeeds module.
🔍 How to Verify
Check if Vulnerable:
Check the xmlfeeds module version in PrestaShop admin under Modules > Module Manager; if version is below 3.9.8, it is vulnerable.Check Version:
No direct CLI command; check via PrestaShop admin interface or inspect module files for version metadata.Verify Fix Applied:
Confirm the xmlfeeds module version is 3.9.8 or higher in the module manager after update.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- HTTP requests to xmlfeeds API endpoints with SQL-like payloads
Network Indicators:
- HTTP POST/GET requests to paths containing 'xmlfeeds' with suspicious parameters
SIEM Query:
source="web_server" AND uri="*xmlfeeds*" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR 1=1*")